puppet 2.6.18 → 2.7.1

data/lib/puppet/configurer/fact_handler.rb

@@ -16,12 +16,7 @@ module Puppet::Configurer::FactHandler
     # compile them and then "cache" them on the server.
     begin
       reload_facter
-      facts = Puppet::Node::Facts.find(Puppet[:node_name_value])
-      unless Puppet[:node_name_fact].empty?
-        Puppet[:node_name_value] = facts.values[Puppet[:node_name_fact]]
-        facts.name = Puppet[:node_name_value]
-      end
-      facts
+      Puppet::Node::Facts.indirection.find(Puppet[:certname])
     rescue SystemExit,NoMemoryError
       raise
     rescue Exception => detail

data/lib/puppet/daemon.rb

@@ -33,9 +33,9 @@ class Puppet::Daemon
       Puppet::Util::Log.reopen
     rescue => detail
       Puppet.err "Could not start #{Puppet[:name]}: #{detail}"
-      Puppet::Util::replace_file("/tmp/daemonout", 0644) do |f|
+      Puppet::Util::secure_open("/tmp/daemonout", "w") { |f|
         f.puts "Could not start #{Puppet[:name]}: #{detail}"
-      end
+      }
       exit(12)
     end
   end

data/lib/puppet/defaults.rb

@@ -116,17 +116,17 @@ module Puppet
       but then ship with tools that do not know how to handle signed ints, so the UIDs show up as
       huge numbers that can then not be fed back into the system.  This is a hackish way to fail in a
       slightly more useful way when that happens."],
+    :route_file => ["$confdir/routes.yaml", "The YAML file containing indirector route configuration."],
     :node_terminus => ["plain", "Where to find information about nodes."],
     :catalog_terminus => ["compiler", "Where to get node catalogs.  This is useful to change if, for instance,
       you'd like to pre-compile catalogs and store them in memcached or some other easily-accessed store."],
     :facts_terminus => {
-      :default => Puppet.application_name.to_s == "master" ? 'yaml' : 'facter', 
+      :default => Puppet.application_name.to_s == "master" ? 'yaml' : 'facter',
       :desc => "The node facts terminus.",
       :hook => proc do |value|
         require 'puppet/node/facts'
-        # Cache to YAML if we're uploading facts away
-        if %w[rest inventory_service].include? value.to_s
-          Puppet::Node::Facts.cache_class = :yaml
+        if value.to_s == "rest"
+          Puppet::Node::Facts.indirection.cache_class = :yaml
         end
       end
     },
@@ -157,7 +157,7 @@ module Puppet
           Puppet.settings[:storeconfigs] = true
 
           # But then we modify the configuration
-          Puppet::Resource::Catalog.cache_class = :queue
+          Puppet::Resource::Catalog.indirection.cache_class = :queue
         else
           raise "Cannot disable asynchronous storeconfigs in a running process"
         end
@@ -206,58 +206,9 @@ module Puppet
       to the fully qualified domain name.",
       :call_on_define => true, # Call our hook with the default value, so we're always downcased
       :hook => proc { |value| raise(ArgumentError, "Certificate names must be lower case; see #1168") unless value == value.downcase }},
-    :certdnsnames => {
-      :default => '',
-      :hook    => proc do |value|
-        unless value.nil? or value == '' then
-          Puppet.warning <<WARN
-The `certdnsnames` setting is no longer functional,
-after CVE-2011-3872. We ignore the value completely.
-
-For your own certificate request you can set `dns_alt_names` in the
-configuration and it will apply locally.  There is no configuration option to
-set DNS alt names, or any other `subjectAltName` value, for another nodes
-certificate.
-
-Alternately you can use the `--dns_alt_names` command line option to set the
-labels added while generating your own CSR.
-WARN
-        end
-      end,
-      :desc    => <<EOT
-The `certdnsnames` setting is no longer functional,
-after CVE-2011-3872. We ignore the value completely.
-
-For your own certificate request you can set `dns_alt_names` in the
-configuration and it will apply locally.  There is no configuration option to
-set DNS alt names, or any other `subjectAltName` value, for another nodes
-certificate.
-
-Alternately you can use the `--dns_alt_names` command line option to set the
-labels added while generating your own CSR.
-EOT
-    },
-    :dns_alt_names => {
-      :default => '',
-      :desc    => <<EOT,
-The comma-separated list of alternative DNS names to use for the local host.
-
-When the node generates a CSR for itself, these are added to the request
-as the desired `subjectAltName` in the certificate: additional DNS labels
-that the certificate is also valid answering as.
-
-This is generally required if you use a non-hostname `certname`, or if you
-want to use `puppet kick` or `puppet resource -H` and the primary certname
-does not match the DNS name you use to communicate with the host.
-
-This is unnecessary for agents, unless you intend to use them as a server for
-`puppet kick` or remote `puppet resource` management.
-
-It is rarely necessary for servers; it is usually helpful only if you need to
-have a pool of multiple load balanced masters, or for the same master to
-respond on two physically separate networks under different names.
-EOT
-    },
+    :certdnsnames => ['', "The DNS names on the Server certificate as a colon-separated list.
+      If it's anything other than an empty string, it will be used as an alias in the created
+      certificate.  By default, only the server gets an alias set up, and only for 'puppet'."],
     :certdir => {
       :default => "$ssldir/certs",
       :owner => "service",
@@ -403,6 +354,8 @@ EOT
         autosigns any key request, and is a very bad idea), false (which
         never autosigns any key request), and the path to a file, which
         uses that configuration file to determine which keys to sign."},
+    :allow_duplicate_certs => [false, "Whether to allow a new certificate
+      request to overwrite an existing certificate."],
     :ca_days => ["", "How long a certificate should be valid.
       This parameter is deprecated, use ca_ttl instead"],
     :ca_ttl => ["5y", "The default TTL for new certificates; valid values
@@ -465,8 +418,7 @@ EOT
       :desc => "Where the puppet master web server logs."
     },
     :masterport => [8140, "Which port puppet master listens on."],
-    :parseonly => [false, "Just check the syntax of the manifests."],
-    :node_name => ["cert", "How the puppetmaster determines the client's identity
+    :node_name => ["cert", "How the puppet master determines the client's identity
       and sets the 'hostname', 'fqdn' and 'domain' facts for use in the manifest,
       in particular for determining which 'node' statement applies to the client.
       Possible values are 'cert' (use the subject's CN in the client's
@@ -535,26 +487,12 @@ EOT
       This should match how often the hosts report back to the server."]
   )
 
+  setdefaults(:device,
+    :devicedir =>  {:default => "$vardir/devices", :mode => "750", :desc => "The root directory of devices' $vardir"},
+    :deviceconfig => ["$confdir/device.conf","Path to the device config file for puppet device"]
+  )
+
   setdefaults(:agent,
-    :node_name_value => { :default => "$certname",
-      :desc => "The explicit value used for the node name for all requests the agent
-        makes to the master. WARNING: This setting is mutually exclusive with
-        node_name_fact.  Changing this setting also requires changes to the default
-        auth.conf configuration on the Puppet Master.  Please see
-        http://links.puppetlabs.com/node_name_value for more information."
-    },
-    :node_name_fact => { :default => "",
-      :desc => "The fact name used to determine the node name used for all requests the agent
-        makes to the master. WARNING: This setting is mutually exclusive with
-        node_name_value.  Changing this setting also requires changes to the default
-        auth.conf configuration on the Puppet Master.  Please see
-        http://links.puppetlabs.com/node_name_fact for more information.",
-      :hook => proc do |value|
-        if !value.empty? and Puppet[:node_name_value] != Puppet[:certname]
-          raise "Cannot specify both the node_name_value and node_name_fact settings"
-        end
-      end
-    },
     :localconfig => { :default => "$statedir/localconfig",
       :owner => "root",
       :mode => 0660,
@@ -590,10 +528,10 @@ EOT
     :runinterval => [1800, # 30 minutes
       "How often puppet agent applies the client configuration; in seconds."],
     :listen => [false, "Whether puppet agent should listen for
-      connections.  If this is true, then by default only the
-      `runner` server is started, which allows remote authorized
-      and authenticated nodes to connect and trigger `puppet agent`
-      runs."],
+      connections.  If this is true, then puppet agent will accept incoming
+      REST API requests, subject to the default ACLs and the ACLs set in 
+      the `rest_authconfig` file. Puppet agent can respond usefully to
+      requests on the `run`, `facts`, `certificate`, and `resource` endpoints."],
     :ca_server => ["$server", "The server to use for certificate
       authority requests.  It's a separate server because it cannot
       and does not need to horizontally scale."],
@@ -673,7 +611,7 @@ EOT
     :inventory_port => ["$masterport",
       "The port to communicate with the inventory_server."
     ],
-    :report => [false,
+    :report => [true,
       "Whether to send reports after every transaction."
     ],
     :lastrunfile =>  { :default => "$statedir/last_run_summary.yaml",
@@ -690,8 +628,8 @@ EOT
     :graphdir => ["$statedir/graphs", "Where to store dot-outputted graphs."],
     :http_compression => [false, "Allow http compression in REST communication with the master.
       This setting might improve performance for agent -> master communications over slow WANs.
-      Your puppetmaster needs to support compression (usually by activating some settings in a reverse-proxy
-      in front of the puppetmaster, which rules out webrick).
+      Your puppet master needs to support compression (usually by activating some settings in a reverse-proxy
+      in front of the puppet master, which rules out webrick).
       It is harmless to activate this settings if your master doesn't support
       compression, but if it supports it, this setting might reduce performance on high-speed LANs."]
   )
@@ -873,9 +811,9 @@ EOT
         if value
           require 'puppet/rails'
           raise "StoreConfigs not supported without ActiveRecord 2.1 or higher" unless Puppet.features.rails?
-          Puppet::Resource::Catalog.cache_class = :active_record unless Puppet.settings[:async_storeconfigs]
-          Puppet::Node::Facts.cache_class = :active_record
-          Puppet::Node.cache_class = :active_record
+          Puppet::Resource::Catalog.indirection.cache_class = :active_record unless Puppet.settings[:async_storeconfigs]
+          Puppet::Node::Facts.indirection.cache_class = :active_record
+          Puppet::Node.indirection.cache_class = :active_record
         end
       end
     }
@@ -892,4 +830,8 @@ EOT
       directories."
     ]
   )
+  setdefaults(
+    :puppetdoc,
+    :document_all => [false, "Document all resources"]
+  )
 end

data/lib/puppet/dsl/resource_type_api.rb

@@ -1,46 +1,34 @@
 require 'puppet/resource/type'
 
+# Type of the objects inside of which pure ruby manifest files are
+# executed.  Provides methods for creating defines, hostclasses, and
+# nodes.
 class Puppet::DSL::ResourceTypeAPI
+  def initialize
+    @__created_ast_objects__ = []
+  end
+
   def define(name, *args, &block)
-    result = __mk_resource_type__(:definition, name, Hash.new, block)
-    result.set_arguments(__munge_type_arguments__(args))
+    args = args.inject([]) do |result, item|
+      if item.is_a?(Hash)
+        item.each { |p, v| result << [p, v] }
+      else
+        result << item
+      end
+      result
+    end
+    @__created_ast_objects__.push Puppet::Parser::AST::Definition.new(name, {:arguments => args}, &block)
     nil
   end
 
   def hostclass(name, options = {}, &block)
-    __mk_resource_type__(:hostclass, name, options, block)
+    @__created_ast_objects__.push Puppet::Parser::AST::Hostclass.new(name, options, &block)
     nil
   end
 
   def node(name, options = {}, &block)
-    __mk_resource_type__(:node, name, options, block)
+    name = [name] unless name.is_a?(Array)
+    @__created_ast_objects__.push Puppet::Parser::AST::Node.new(name, options, &block)
     nil
   end
-
-  # Note: we don't want the user to call the following methods
-  # directly.  However, we can't stop them by making the methods
-  # private because the user's .rb code gets instance_eval'ed on an
-  # instance of this class.  So instead we name the methods using
-  # double underscores to discourage customers from calling them.
-
-  def __mk_resource_type__(type, name, options, code)
-    klass = Puppet::Resource::Type.new(type, name, options)
-
-    klass.ruby_code = code if code
-
-    Thread.current[:known_resource_types].add klass
-
-    klass
-  end
-
-  def __munge_type_arguments__(args)
-    args.inject([]) do |result, item|
-      if item.is_a?(Hash)
-        item.each { |p, v| result << [p, v] }
-      else
-        result << item
-      end
-      result
-    end
-  end
 end

data/lib/puppet/external/nagios/parser.rb

@@ -753,7 +753,7 @@ module_eval <<'.,.,', 'grammar.ry', 40
 
 module_eval <<'.,.,', 'grammar.ry', 42
   def _reduce_10( val, _values, result )
-result = {val[0],val[1]}
+result = {val[0] => val[1]}
   result
 end
 .,.,

data/lib/puppet/face.rb

@@ -0,0 +1,12 @@
+# The public name of this feature is 'face', but we have hidden all the
+# plumbing over in the 'interfaces' namespace to make clear the distinction
+# between the two.
+#
+# This file exists to ensure that the public name is usable without revealing
+# the details of the implementation; you really only need go look at anything
+# under Interfaces if you are looking to extend the implementation.
+#
+# It isn't hidden to gratuitously hide things, just to make it easier to
+# separate out the interests people will have.  --daniel 2011-04-07
+require 'puppet/interface'
+Puppet::Face = Puppet::Interface

data/lib/puppet/face/catalog.rb

@@ -0,0 +1,130 @@
+require 'puppet/indirector/face'
+
+Puppet::Indirector::Face.define(:catalog, '0.0.1') do
+  copyright "Puppet Labs", 2011
+  license   "Apache 2 license; see COPYING"
+
+  summary "Compile, save, view, and convert catalogs."
+  description <<-'EOT'
+    This subcommand deals with catalogs, which are compiled per-node artifacts
+    generated from a set of Puppet manifests. By default, it interacts with the
+    compiling subsystem and compiles a catalog using the default manifest and
+    `certname`, but you can change the source of the catalog with the
+    `--terminus` option. You can also choose to print any catalog in 'dot'
+    format (for easy graph viewing with OmniGraffle or Graphviz) with
+    '--render-as dot'.
+  EOT
+  short_description <<-'EOT'
+    This subcommand deals with catalogs, which are compiled per-node artifacts
+    generated from a set of Puppet manifests. By default, it interacts with the
+    compiling subsystem and compiles a catalog using the default manifest and
+    `certname`; use the `--terminus` option to change the source of the catalog.
+  EOT
+
+  get_action(:destroy).summary "Invalid for this subcommand."
+  get_action(:search).summary "Invalid for this subcommand."
+  find = get_action(:find)
+  find.summary "Retrieve the catalog for a node."
+  find.arguments "<certname>"
+  find.returns <<-'EOT'
+    A serialized catalog. When used from the Ruby API, returns a
+    Puppet::Resource::Catalog object.
+  EOT
+
+  action(:apply) do
+    summary "Find and apply a catalog."
+    description <<-'EOT'
+      Finds and applies a catalog. This action takes no arguments, but
+      the source of the catalog can be managed with the `--terminus` option.
+    EOT
+    returns <<-'EOT'
+      Nothing. When used from the Ruby API, returns a
+      Puppet::Transaction::Report object.
+    EOT
+    examples <<-'EOT'
+      Apply the locally cached catalog:
+
+      $ puppet catalog apply --terminus yaml
+
+      Retrieve a catalog from the master and apply it, in one step:
+
+      $ puppet catalog apply --terminus rest
+
+      From `secret_agent.rb` (API example):
+
+          # ...
+          Puppet::Face[:catalog, '0.0.1'].download
+          # (Termini are singletons; catalog.download has a side effect of
+          # setting the catalog terminus to yaml)
+          report  = Puppet::Face[:catalog, '0.0.1'].apply
+          # ...
+    EOT
+
+    when_invoked do |options|
+      catalog = Puppet::Face[:catalog, "0.0.1"].find(Puppet[:certname]) or raise "Could not find catalog for #{Puppet[:certname]}"
+      catalog = catalog.to_ral
+
+      report = Puppet::Transaction::Report.new("apply")
+      report.configuration_version = catalog.version
+
+      Puppet::Util::Log.newdestination(report)
+
+      begin
+        benchmark(:notice, "Finished catalog run") do
+          catalog.apply(:report => report)
+        end
+      rescue => detail
+        puts detail.backtrace if Puppet[:trace]
+        Puppet.err "Failed to apply catalog: #{detail}"
+      end
+
+      report.finalize_report
+      report
+    end
+  end
+
+  action(:download) do
+    summary "Download this node's catalog from the puppet master server."
+    description <<-'EOT'
+      Retrieves a catalog from the puppet master and saves it to the local yaml
+      cache. This action always contacts the puppet master and will ignore
+      alternate termini.
+
+      The saved catalog can be used in any subsequent catalog action by specifying
+      '--terminus yaml' for that action.
+    EOT
+    returns "Nothing."
+    notes <<-'EOT'
+      When used from the Ruby API, this action has a side effect of leaving
+      Puppet::Resource::Catalog.indirection.terminus_class set to yaml. The
+      terminus must be explicitly re-set for subsequent catalog actions.
+    EOT
+    examples <<-'EOT'
+      Retrieve and store a catalog:
+
+      $ puppet catalog download
+
+      From `secret_agent.rb` (API example):
+
+          Puppet::Face[:plugin, '0.0.1'].download
+          Puppet::Face[:facts, '0.0.1'].upload
+          Puppet::Face[:catalog, '0.0.1'].download
+          # ...
+    EOT
+    when_invoked do |options|
+      Puppet::Resource::Catalog.indirection.terminus_class = :rest
+      Puppet::Resource::Catalog.indirection.cache_class = nil
+      catalog = nil
+      retrieval_duration = thinmark do
+        catalog = Puppet::Face[:catalog, '0.0.1'].find(Puppet[:certname])
+      end
+      catalog.retrieval_duration = retrieval_duration
+      catalog.write_class_file
+
+      Puppet::Resource::Catalog.indirection.terminus_class = :yaml
+      Puppet::Face[:catalog, "0.0.1"].save(catalog)
+      Puppet.notice "Saved catalog for #{Puppet[:certname]} to yaml"
+      nil
+    end
+  end
+end

data/lib/puppet/face/catalog/select.rb

@@ -0,0 +1,49 @@
+# Select and show a list of resources of a given type.
+Puppet::Face.define(:catalog, '0.0.1') do
+  action :select do
+    summary "Retrieve a catalog and filter it for resources of a given type."
+    arguments "<host> <resource_type>"
+    returns <<-'EOT'
+      A list of resource references ("Type[title]"). When used from the API,
+      returns an array of Puppet::Resource objects excised from a catalog.
+    EOT
+    description <<-'EOT'
+      Retrieves a catalog for the specified host, then searches it for all
+      resources of the requested type.
+    EOT
+    notes <<-'NOTES'
+      By default, this action will retrieve a catalog from Puppet's compiler
+      subsystem; you must call the action with `--terminus rest` if you wish
+      to retrieve a catalog from the puppet master.
+
+      FORMATTING ISSUES: This action cannot currently render useful yaml;
+      instead, it returns an entire catalog. Use json instead.
+    NOTES
+    examples <<-'EOT'
+      Ask the puppet master for a list of managed file resources for a node:
+
+      $ puppet catalog select --terminus rest somenode.magpie.lan file
+    EOT
+    when_invoked do |host, type, options|
+      # REVISIT: Eventually, type should have a default value that triggers
+      # the non-specific behaviour.  For now, though, this will do.
+      # --daniel 2011-05-03
+      catalog = Puppet::Resource::Catalog.indirection.find(host)
+
+      if type == '*'
+        catalog.resources
+      else
+        type = type.downcase
+        catalog.resources.reject { |res| res.type.downcase != type }
+      end
+    end
+
+    when_rendering :console do |value|
+      if value.nil? then
+        "no matching resources found"
+      else
+        value.map {|x| x.to_s }.join("\n")
+      end
+    end
+  end
+end